fix(desktop): respect profile scope for cron jobs and messaging sessions

[lerryzou]

Problem

When a non-default profile is selected in the Desktop App sidebar, cron jobs from ALL profiles are displayed instead of just the active profile's jobs. This violates profile isolation and confuses users who expect to see only their current profile's data.

Root Cause

Four functions in the Desktop App frontend were hardcoded to fetch data from 'all' profiles, ignoring the active profile context:

1. refreshCronSessions() - always passed profile='all'
2. refreshMessagingSessions() - always passed profile='all'
3. loadMoreMessagingForPlatform() - always passed profile='all'
4. getCronJobs() - didn't pass any profile parameter (backend defaulted to 'all')

Solution

Updated these functions to respect the profileScope computed store, which reflects the currently selected profile in the sidebar. Each function now:

• Uses profileScope instead of hardcoded 'all'
• Includes profileScope in the useCallback dependency array to ensure refetch on profile change

Testing

• Verified lint passes: npm run lint
• Verified relevant tests pass: npm test for cron and messaging components
• Manual testing confirmed: switching profiles now shows only that profile's cron jobs and messaging sessions

Impact

• Fixes Desktop App (macOS): Non-default profile shows sessions and cron jobs from default profile — cross-profile data leak in UI #52401 (Desktop App shows wrong profile's cron jobs)
• Improves profile isolation UX
• No breaking changes - single-profile users unaffected

[alt-glitch]

This was generated by AI during triage.

Related: competing-cluster member for desktop profile-scoping. Fixes #52401 (superset issue) and overlaps the cron-sidebar cluster (#51520 spec; competing fix PRs #42654 call-site arg, #47429 helper-internal profileScoped() spread, #51531 ?profile= via _apiProfile). This PR is broader — it also scopes messaging sessions, not just cron jobs. Same goal, different mechanism across the cluster; a maintainer should pick one approach. Not a duplicate of any sibling.

[teknium1]

Thanks for tracing the cross-profile sidebar leak. The underlying bug remains on current main, but this patch needs a targeted salvage.

Problems

• The three session callbacks moved from apps/desktop/src/app/desktop-controller.tsx to apps/desktop/src/app/session/hooks/use-session-list-actions.ts:84-139 in 25c7900fb58239552c530fd6cf8be28e5efbcec4, so the frontend hunk no longer applies.
• apps/desktop/src/hermes.ts in this PR builds the cron query from _apiProfile, whereas the sidebar is governed by profileScope. apps/desktop/src/store/profile.ts:294-295 supports explicit ALL_PROFILES; in that mode _apiProfile still follows the active gateway profile, so this would filter the All profiles view to one profile.
• Please add profile-scoping regression coverage. Current apps/desktop/src/hermes.test.ts:96-112 covers only the unscoped cron path.

Suggested changes

• Port the three session calls to use-session-list-actions.ts and pass profileScope === ALL_PROFILES ? 'all' : profileScope.
• Give getCronJobs an explicit scope argument and pass the sidebar scope through all callers, including the Cron view.

Automated hermes-sweeper review.

[teknium1]

_apiProfile follows the active gateway profile, but the sidebar may be in explicit All profiles mode ($profileScope === ALL_PROFILES). In that mode this sends one active profile rather than profile=all. Accept the sidebar scope as a getCronJobs argument and pass profileScope === ALL_PROFILES ? 'all' : profileScope from the callers.

[teknium1]

Status update: the cron-jobs half of this PR is now superseded — profileScoped() routing landed via #67493, the contract test via #67602, and the endpoint-level ?profile= list scoping (sidebar + overlay) via #67615, merged today. The messaging/cron session fetch scoping half overlaps #60688's territory and is not yet covered on main — that half still stands. If you rebase onto current main and narrow to the listAllProfileSessions scoping (coordinating with #60688, which targets the same call sites), it can be reviewed on its own merits. Leaving open for that half.

[teknium1]

Resolved on main by #87566 — cron and messaging sidebar slices now follow the selected profile end to end. You submitted this early in the cluster (June 26); thanks for the contribution!